ArpCut

ArpCut An ARP spoofing-based LAN disconnection tool requires Root. Continuously sends forged ARP replies to LAN devices to cut off their network connections, and provides device identification, notes, whitelist, and operation records. Project Homepage Feature Overview LAN device scanning root sca...

cve-2010-3847

CVE-2010-3847 script Meant to automate the exploit discussed in http://marc.info/?l=full-disclosure&m=128776663124692&w=2. Tested on CentOS 5 x86. The DSO it outputs is compiled from the following code: include include include void attributeconstructor init setuid0; system"/bin/bash"; Usage...

ROOT-APP-PYPI-CVE-2026-23949 CVE-2026-23949 in jaraco.context - Patched by Root

Root has patched CVE-2026-23949 in the jaraco.context package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-GHSA-58PV-8J8X-9VJ2 GHSA-58pv-8j8x-9vj2 in jaraco.context - Patched by Root

Root has patched GHSA-58pv-8j8x-9vj2 in the jaraco.context package for Root:PyPI. Multiple fixed versions available...

CVE-2019-2215

CVE-2019-2215 Temproot for Bravia TV via CVE-2019-2215. Overview Demonstration of a kernel memory R/W-only privilege escalation attack resulting in a temporary root shell. It works on Sony Bravia TV devices running the Android 8 PKG6.0724 firmware with kernel version 4.9.51. For this tool to work...

Exploit for CVE-2026-112445

CVE-2026-112445: The Simplest macOS Local Privilege Escalation...

Exploit for CVE-2026-98260

GhostKey — CVE-2026-98260 One-Click Privilege Escalation Tool...

Rucio Has An Authorization Bypass On REST API Endpoint For Signing URLs

Summary The "/credentials/signurl" endpoint decides authorization from the client-supplied "X-Rucio-Account" HTTP header instead of the authenticated token's account. Any client holding any valid auth token even a low-privilege account they legitimately own can send "X-Rucio-Account: root" to pas...

Exploit for CVE-2026-98260

GhostKey — CVE-2026-98260 One-Click Privilege Escalation Tool...

CVE-2026-79589

The WIFI4 N300 router Model: T1 Pro v1.0.0 by U-speed contains an insecure access control flaw that allows an attacker to gain unauthenticated root shell. The vulnerability is caused by the exposure of the UART debugging interface having a lack of authentication, authorization and access control...

Nozomi Networks Guardian encryption issue vulnerability

Versions prior to Nozomi Networks Guardian 26.4.0 and CMC 26.4.0 contain an encryption vulnerability. This vulnerability stems from inconsistent validation of update package contents by the update installation functionality. As a result, attackers with administrative privileges can remotely deliv...

PT-2026-132166

Name of the Vulnerable Software and Affected Versions U-speed WIFI4 N300 router Model: T1 Pro version 1.0.0 Description An insecure access control flaw exists due to the exposure of the UART debugging interface, which lacks authentication, authorization, and access control functionality. An...

CVE-2026-33923: Nozomi Networks: A signature verification vulnerability was discovered in the update installation functionality due to inconsistent…

A signature verification vulnerability was discovered in the update installation functionality due to inconsistent validation of the update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bundle that passes signature verification but runs an unsign...

CVE-2026-61707: socfortress CoPilot: SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs

SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, in the reported deployment, case-report templates uploaded by customeruser, the lowest-privilege portal role, are later executed by non-sandboxed Jinja2 engines when an admin o...

PT-2026-132476

Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attackers can send MKCOL /.. to plant a VFS node, then PUT, MOVE, COPY, or MKCOL to create, overwrite, o...

PT-2026-132449

OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-root, sys/rekey, and sys/rekey-recovery-key endpoints when request audit logging succeeds but response audit logging fails. An attacker using these endpoints can complete root...

CVE-2026-79589

The U-speed WIFI4 N300 router (Model: T1 Pro) v1.0.0 is vulnerable to an insecure access control flaw. The vulnerability is caused by the exposure of the UART debugging interface , which lacks authentication, authorization, and access control functionality. An attacker with physical access who so...

Authenticated RCE in update functionality in Guardian/CMC before 26.4.0

Summary Two OS command injection vulnerabilities were discovered in the update installation functionality due to insufficient validation of the update bundle contents. Impact An attacker with administrative privileges can remotely supply a crafted update bundle that, when installed, causes...

CVE-2026-33924: Nozomi Networks: Two OS command injection vulnerabilities were discovered in the update installation functionality due to insufficient…

Two OS command injection vulnerabilities were discovered in the update installation functionality due to insufficient validation of the update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bundle that, when installed, causes arbitrary commands to...

ArubaOS 8.10.x < 8.10.0.24 / 8.13.x < 8.13.3.1 Multiple Vulnerabilities (HPESBNW05162)

The version of ArubaOS AOS-8 installed on the remote host is affected by multiple vulnerabilities as referenced in the HPESBNW05162 advisory: - Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands ...